Zabbix CVE-2026-1199

No special configuration is required beyond a reachable Zabbix login endpoint (API or frontend). The vulnerability exists in the default lockout mechanism itself, so any Zabbix deployment with login lockout enabled and exposed to a network where an attacker can open multiple simultaneous connections is susceptible. Exploitation is limited by network accessibility - instances restricted to VPN or internal networks require the attacker to already have network-level access. The attacker must know or enumerate a valid username to target, which constrains impact to accounts whose usernames are discoverable (e.g., the well-known default 'Admin' account). Authentication is not required to exploit the race condition.

The CVSS 4.0 base score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N reflects a network-accessible, no-prerequisites attack with low confidentiality impact (VC:L) and no integrity or availability impact. The practical risk is a weakened brute-force defense rather than direct data exfiltration, so the moderate score is proportionate. No KEV listing and no publicly available exploit code are identified, which reduces immediate urgency. However, Zabbix is widely deployed in enterprise and data-center environments for monitoring critical infrastructure, meaning a successful credential brute-force against a Zabbix admin account could yield significant secondary access. The race condition is straightforward to exploit using any concurrent HTTP client, lowering practical attack complexity below what AC:L already implies. Overall, this is a real priority for Zabbix instances exposed to untrusted networks or the internet, but less urgent for air-gapped or VPN-restricted deployments.

An attacker targeting a Zabbix instance sends a high-volume burst of parallel HTTP POST requests to the login endpoint, each attempting a different password for a known username such as the default 'Admin' account. Because the concurrent requests race past the lockout counter before it is properly incremented, many attempts are processed before the account is blocked, allowing effective brute-force or credential-stuffing. No public proof-of-concept code is identified, but standard HTTP concurrency tools are sufficient to trigger the race condition.